Western Electric 30C Payphone Lock

[huxleypig]

This lock has taken up a massive amount of my time over the years. Studying it, thinking of a way to pick it, trying it, failing, repeat. There is no way I can see to pick this lock without bypassing the blocker on it. So after another round of nights working on it, I have found a practical and very easy way to bypass it. I find it crazy that most of the bypasses on locks take so long to hunt down and yet are so bloody simple.

I can never know if this is the technique the James Clark (the Phone Ranger) used all those years ago because I am sure there are many solutions to the problem. Here is mine. The blocker traps levers at their height before the stump is tested. You can introduce a piece of wire into the keyway that raises a lever up to its maximum height, BUT as it is not the key you are not restricted to keeping it there. You can raise the lever up higher, past the highest height, as simulated with a screwdriver below (this would be done from within the keyway, obviously):



You can see that you do not have to go very far past the highest cut height, maybe 1 more cut's width.

This has the effect of keeping the blocker held back just a bit, enough to pick the rest of the levers unimpeded. Now the bad news: Even without the blocker, the lock has 8 tiny levers that all have false gates. Also, having a lever raised too high will obviously stop the lock from ever opening. Fortunately, the overlifted lever will bind last due to the slightly curved shape of the lever. Which means that if you remove support for it, the spring at the top is stronger than the blocker springs (without the teeth to lock it in place) and the lever will fall right down, at which point you only have to raise it up (against the blocker teeth and spring, tough but doable (not a practical way to pick the lock from the outset though)). There is also another piece of bad news though; if you are over-zealous with your lever overlifting, then the following can happen:



If any lever gets trapped up there then it is goodnight Vienna, not even the real key will open this lock, it is borked. It is actually quite tricky to get the lever trapped like this though, you have to put on a lot of pressure (enough to deform the lever a little) so in practicality, it should never happen but it is an interesting way to brick the lock!

[madsamurai]

Interesting puzzle, there... Hard to tell much without hands on it, but It almost looks like once the lever is trapped in the spring you could lift it up high enough that the fence might clear beneath it. Would it be possible to overlift all of the levers into that trapped state and then lift them all up high enough you could slip the fence underneath the entire lever stack?

[huxleypig]

You can, you can lift them all up super-high and trap the lot. It then becomes a question of how well the thing is fitted because the bolt will retract to about 3/5 of its travel by going underneath the lot of them. I think the lock might be able to be jimmied when it is is this situation. It won't retract fully though.

I've refined the technique in the OP a little, I am convinced this is going to get picked really soon.

[indigoalpha6]

pretty cool. i've really been wanting to get one of these myself. one of the things i do with safe deposit locks like the S&G 4440 is to use a wire to feel whether the true gates of the levers have aligned with the stump. the idea i had for the 30C was to maybe position a wire along the bolt "fence" to verify when the gates are in line. but with the "claw" up there, you would also need to push that out of the way as well. not easy me thinks and would certainly put too much junk in the keyway to keep track of.

keep up the good work and thanks for sharing! let us know when you spring this thing. this is important work.

[macgng]

Very interesting hux.... They actually did make locks that trap the keys inside of the lock and it becomes completely unusable ... The lock and the key...

How practical is this method when the lock is actually mounted in the phone?

Definitely a start! I know you will figure it out!

[indigoalpha6]

i'm not an expert but one of the reasons is that having the key retained helped the phone co get the hatches open. often you'll find a 29A/A71 or 29B paired with a 30C on either the electrical vault or the coin vault. also some of them had an overlift detector that would trip a switch that would signal the phone co when a "pick" was in progress.

[huxleypig]

Oh shit, I was wondering what the little plastic tab was for there. Right at the top, you're right, it won't detect if you overlift the lever a little but if you crank it up high it would trip! There would have to be a sprung pressure on the outside of the lock (simulated with my thumb), to keep it depressed against the pressure of the top spring but I can see how that'd work. Awesome.

That suggests that they knew about the bypass and were almost daring people to do it? So someone overlifts everything, sets of the tamper, and struggles to jimmy a half-open lock until the cops arrive! Plus, it makes my technique a real tightrope!! I should set it up with the tamper switch and try to pick it without setting it off. I wonder if that's what Clark did?

I didn't think it were possible. But the lock just got even cooler!



On a payphone Mac? I dunno, I think the tensioner could be made to pretty accurately hold up one of the levers. The actual picking of the levers would be the hard bit but that happens thousands of times a day on some good UK/safe lever locks. Tough but possible. It happened, so...

[indigoalpha6]

yep, you've got the switch button.

amazing how a lock invented by non-lock people has been kicking asses for 50 yrs

you could wire a micro switch to a small battery to zap you as a reminder to never engage in such deviant behavior!

[ratlock]

Cool lock.

[huxleypig]

yep, you've got the switch button.

amazing how a lock invented by non-lock people has been kicking asses for 50 yrs

you could wire a micro switch to a small battery to zap you as a reminder to never engage in such deviant behavior!

I am going to wire it up to a buzzer fur sure. It'd be really cool if someone had a picture of the original switch mech, from the phone box so I knew exactly where/how far it got set.

I have changed my technique a little now (because duelling with the prospect of setting off a tamper is not my idea of fun). I can now bypass the blocker without overlifting anything.

I still find it incredible that they left that tamper trap in there. It would've been so easy to put a little tab of plastic or something in there to stop you from ever overlifting anything but they didn't, lol. Really, really crafty.

[indigoalpha6]

sounds like you're making progress. -awesome!

payphones are collectables here in the states. maybe on some collector forum there may be some pictures or specs or something.

when i was a kid we lived near a phone co building. -rows and rows of switch boards i could see through those dirty windows. they were going electronic and gutting the works and i'd hop the fence and rummage through the dumpsters picking up tons of cool "stuff" on the weekends. saw a lot of phones in those bins! but that was about 5 or so years before i got into picking. i should have tried to drag one home and hid it under the house!

some quick searching shows some drill point diagrams for some tangential lock models and some phone company security tech docs but nothing solid on the 30C yet

[macgng]

Hux, i will ask my guy about that plastic tab..... You know how many payphone locks i have,, and not once have i ever noticed that until now.... I do have some switches in my phone parts box.... give me the rest of the week and i might actually set mine up if its the right switch and post some pictures.

[indigoalpha6]

not the first squawk button i've seen. you won't find them on upper housing locks, only on the coin vault. until now they appeared to be particular to the 30C with the "H1" die-cast bolt for use in the states. the variants made by AE and NE don't seem to have them and Huxley's specimen has an entirely different bolt altogether.

[pickmonger2]

Matt Blaze did a paper on this lock. It may or may not be of interest to someone .

http://www.crypto.com/photos/misc/wecolock/

[huxleypig]

That Matt Blaze paper is very good and he allowed me to use some of his photographs for a talk I did a while ago. However, I was always disappointed with the lack of exploitation content in there.